How we protect your documents

1. Encryption at Rest

Your documents are the core of ContractMate, so they get the strongest protection we can give them:

• Document files: Every uploaded PDF is encrypted with AES-256 using a password you choose. The file on our servers cannot be opened without it.
• Extracted text: The text we extract from your documents (used for search and the AI Assistant) is stored encrypted in our database — it is not readable in plain text, even in database backups.
• Document passwords: Stored encrypted, never in plain text.
• Account passwords: Stored as salted one-way hashes. We cannot see your password, and neither can anyone else.

2. Encryption in Transit

All traffic between your browser and our servers is encrypted with TLS (HTTPS). We do not serve any part of the application over unencrypted connections.

3. Where Your Data Lives

ContractMate is hosted on servers in Germany. Your documents, account data, metadata, and backups all stay within the European Union. The only exception is AI processing, described below. Every third-party provider we use is listed on our Subprocessors page with its processing location and safeguards.

4. AI Processing

We believe in being precise about this trade-off:

• When you chat with a document, its extracted text and your question are sent to OpenAI (USA) to generate the answer. This transfer is covered by the EU Standard Contractual Clauses in our data processing agreement.
• Your content is never used to train AI models and is not retained by the AI provider.
• AI processing only happens when you actively use the AI Assistant. If you never use it, your document content never leaves the EU.
• Chat conversations are not stored on our servers — they exist only in your browser session.

5. Access & Authentication

• HTTP-only, secure cookies: Your session cannot be read by scripts in the browser, which protects against cross-site scripting attacks.
• Short-lived sessions: Access tokens expire quickly and are refreshed with rotating refresh tokens that can be revoked server-side.
• Two-factor authentication: You can require a 6-digit code from an authenticator app in addition to your password, with single-use recovery codes as a backup. Enable it in Account settings.
• Rate limiting: Login and verification endpoints are rate-limited to block password-guessing attacks.
• Strict document isolation: Every document request is verified against your account. Stored file paths are validated on every access.

6. Backups & Deletion

• We take automated daily database backups so your data survives hardware failure. Backups stay on EU servers.
• Document text inside backups is encrypted, just as it is in the live database.
• Backups are automatically purged after 30 days.
• When you delete a document, the file is removed from our servers immediately. When you delete your account, all your documents and data are deleted. Residual copies in backups are purged within the 30-day backup window.

7. Your Controls

• Your document password: You choose the password each document is encrypted with.
• Analytics consent: Product analytics only run after you explicitly opt in, and never include document content.
• Full GDPR rights: Access, correction, export, and deletion of your data — see our Privacy Policy for how to exercise them.

8. Reporting a Vulnerability

If you believe you have found a security issue in ContractMate, please email us at info@contractmate.de with "Security report" in the subject line. We read every report and will respond as quickly as we can. Please do not access other users' data or disrupt the service while investigating.